What’s Vulnerable › Vulnerabilities
CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2022-05-25
- EPSS: 68.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2015-08-08 · updated 2026-06-17
- Weakness: CWE-346
Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 15.04
- Mozilla Firefox: before 39.0.3; from 38.0 before 38.1.1 — fixed in 38.1.1, 39.0.3
- Mozilla Firefox Os: before 2.2 — fixed in 2.2
- Opensuse: 13.1, 13.2
- Oracle Corporation Solaris Operating System: 11.3
- RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
- RedHat Enterprise Linux Eus: 6.7, 7.1, 7.2, 7.3, 7.4, 7.5 (+2)
- RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
- RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
- RedHat Enterprise Linux Server Tus: 7.3, 7.6, 7.7
- RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
- SUSE Linux Enterprise Debuginfo: 11-sp1, 11-sp2, 11-sp3, 11-sp4
- SUSE Linux Enterprise Server 15 SP1: 11-sp3, 11-sp4, 12
- SUSE Linux Enterprise Server: 11-sp1, 11-sp2, 11-sp3, 11-sp4, 12
- SUSE Linux Enterprise Software Development Kit: 11-sp3, 11-sp4, 12
How to fix
Upgrade to a fixed version: Mozilla Firefox 38.1.1, 39.0.3; Mozilla Firefox Os 2.2. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html
- http://rhn.redhat.com/errata/RHSA-2015-1581.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/76249
- http://www.securitytracker.com/id/1033216
- http://www.ubuntu.com/usn/USN-2707-1
Get alerted when CVE-2015-4495 or the next vulnerability affects your stack